Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
9 vulnerabilities
CVE-2026-16247 (GCVE-0-2026-16247)
Vulnerability from cvelistv5 – Published: 2026-07-20 11:54 – Updated: 2026-07-20 12:55
VLAI
EPSS
VEX
Title
Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
Summary
In _connect.BRAIN versions prior to 5.06,
the application LogPathConfig.exe is executed during setup. During this
process, existing permissions on %ProgramData% are deleted and replaced,
granting the Windows group Everyone full control instead of restricting
access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.
Starting with _connect.BRAIN 5.06,
the setup no longer executes this tool.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | _connect.BRAIN |
Affected:
>5.06
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T12:55:33.275252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:55:40.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "_connect.BRAIN",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"status": "affected",
"version": "\u003e5.06"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn \u003cb\u003e_connect.BRAIN versions prior to 5.06\u003c/b\u003e,\nthe application \u003cb\u003eLogPathConfig.exe\u003c/b\u003e is executed during setup. During this\nprocess, existing permissions on \u003cb\u003e%ProgramData%\u003c/b\u003e are deleted and replaced,\ngranting the Windows group \u003cb\u003eEveryone\u003c/b\u003e full control instead of restricting\naccess to \u003cb\u003e%ProgramData%\\Bizerba\\_connect.BRAIN\u003c/b\u003e or\u003cb\u003e %ProgramData%\\Bizerba\\BCT\u003c/b\u003e.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eStarting with \u003cb\u003e_connect.BRAIN 5.06\u003c/b\u003e,\nthe setup no longer executes this tool.\u003c/p\u003e"
}
],
"value": "In _connect.BRAIN versions prior to 5.06,\nthe application LogPathConfig.exe is executed during setup. During this\nprocess, existing permissions on %ProgramData% are deleted and replaced,\ngranting the Windows group Everyone full control instead of restricting\naccess to %ProgramData%\\Bizerba\\_connect.BRAIN or %ProgramData%\\Bizerba\\BCT.\n\n\n\n\n\n\n\n\n\nStarting with _connect.BRAIN 5.06,\nthe setup no longer executes this tool."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T11:54:37.566Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\n \u003cli\u003eUpgrade to \u003cb\u003e_connect.BRAIN 5.06 or later\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eImportant:\u003c/b\u003e\u003cbr\u003e\n An update does not restore previously overwritten permissions on \u003cb\u003e%ProgramData%\u003c/b\u003e.\u003cbr\u003e\n Permissions must be manually reviewed and corrected by a Windows\n administrator.\u003c/li\u003e\n\u003c/ul\u003e\n\nOnly a \u003cb\u003efresh installation\u003c/b\u003e of \u003cb\u003e_connect.BRAIN\n5.06 or later\u003c/b\u003e ensures that the issue does not occur during setup."
}
],
"value": "* Upgrade to _connect.BRAIN 5.06 or later\n\n * Important:\n\n An update does not restore previously overwritten permissions on %ProgramData%.\n\n Permissions must be manually reviewed and corrected by a Windows\n administrator.\n\n\n\n\n\nOnly a fresh installation of _connect.BRAIN\n5.06 or later ensures that the issue does not occur during setup."
}
],
"source": {
"advisory": "BIZERBA-SA-2026-0003",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-07T22:00:00.000Z",
"value": "Release of _connect.BRAIN"
}
],
"title": "Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn automatic correction is not possible, as\nrestoring permissions on \u003cb\u003e%ProgramData%\u003c/b\u003e may affect other installed\nsoftware.\u003c/p\u003e\u003cp\u003eA Windows administrator can reduce the risk\nby:\u003c/p\u003e\u003cp\u003e\n\n\n\n\u003c/p\u003e\u003cul\u003e\n \u003cli\u003ereviewing and restoring required permissions on \u003cb\u003e%ProgramData%\u003c/b\u003e,\n and\u003c/li\u003e\n \u003cli\u003eremoving full control permissions for \u003cb\u003eEveryone\u003c/b\u003e, and\u003c/li\u003e\n \u003cli\u003eassigning full control permissions for \u003cb\u003eEveryone\u003c/b\u003e\n specifically to \u003cb\u003e%ProgramData%\\Bizerba\\_connect.BRAIN\u003c/b\u003e or\u003cb\u003e %ProgramData%\\Bizerba\\BCT\u003c/b\u003e.\u003c/li\u003e\n\u003c/ul\u003e\u003cul\u003e\n\u003c/ul\u003e"
}
],
"value": "An automatic correction is not possible, as\nrestoring permissions on %ProgramData% may affect other installed\nsoftware.\n\n\n\nA Windows administrator can reduce the risk\nby:\n\n\n\n\n\n\n\n\n\n\n * reviewing and restoring required permissions on %ProgramData%,\n and\n\n * removing full control permissions for Everyone, and\n\n * assigning full control permissions for Everyone\n specifically to %ProgramData%\\Bizerba\\_connect.BRAIN or %ProgramData%\\Bizerba\\BCT."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2026-16247",
"datePublished": "2026-07-20T11:54:37.566Z",
"dateReserved": "2026-07-20T07:04:24.445Z",
"dateUpdated": "2026-07-20T12:55:40.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16246 (GCVE-0-2026-16246)
Vulnerability from cvelistv5 – Published: 2026-07-20 11:51 – Updated: 2026-07-20 13:02
VLAI
EPSS
VEX
Title
Insecure permission assignment due to execution of LogPathConfig.exe during setup
Summary
In BRAIN2 versions prior to 3.09, the
application LogPathConfig.exe is executed during setup. As a result, the
Windows group Everyone is granted full control over %ProgramData% instead of
being restricted to %ProgramData%\Bizerba\BRAIN2\.
Starting with BRAIN2 3.09, the setup no
longer executes this tool.
However, the optional component Bizerba ScriptService still executes it.
Bizerba ScriptService is being
deprecated and will no longer be included starting with BRAIN2 version 3.11.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 |
Affected:
>3.09
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:02:39.900691Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:02:48.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "BRAIN2",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"status": "affected",
"version": "\u003e3.09"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cb\u003eIn BRAIN2 versions prior to 3.09, the\napplication LogPathConfig.exe is executed during setup. As a result, the\nWindows group Everyone is granted full control over %ProgramData% instead of\nbeing restricted to %ProgramData%\\Bizerba\\BRAIN2\\.\u003c/b\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eStarting with BRAIN2 3.09, the setup no\nlonger executes this tool.\u003cbr\u003e\nHowever, the optional component Bizerba ScriptService still executes it.\u003c/b\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eBizerba ScriptService is being\ndeprecated and will no longer be included starting with BRAIN2 version 3.11.\u003c/b\u003e\u003c/p\u003e"
}
],
"value": "In BRAIN2 versions prior to 3.09, the\napplication LogPathConfig.exe is executed during setup. As a result, the\nWindows group Everyone is granted full control over %ProgramData% instead of\nbeing restricted to %ProgramData%\\Bizerba\\BRAIN2\\.\n\n\n\n\n\nStarting with BRAIN2 3.09, the setup no\nlonger executes this tool.\n\nHowever, the optional component Bizerba ScriptService still executes it.\n\n\n\n\n\nBizerba ScriptService is being\ndeprecated and will no longer be included starting with BRAIN2 version 3.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T11:55:07.681Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\n \u003cli\u003e\u003cb\u003eUpgrade to BRAIN2 version 3.09 or later\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eImportant: An update alone does not remove the incorrectly\n assigned permissions on %ProgramData%. These permissions must be manually\n corrected by a Windows administrator.\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eOnly a fresh installation of BRAIN2 3.09 or later without\n installing Bizerba ScriptService prevents the issue during setup.\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eDo not install Bizerba ScriptService and use the BRAIN2 Device\n Control Service instead\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eStarting with BRAIN2 3.11, Bizerba ScriptService will no longer\n be included in the delivery\u003c/b\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cdiv\u003e\u003cb\u003e\n\n\n\n\u003c/b\u003e\u003c/div\u003e"
}
],
"value": "* Upgrade to BRAIN2 version 3.09 or later\n\n * Important: An update alone does not remove the incorrectly\n assigned permissions on %ProgramData%. These permissions must be manually\n corrected by a Windows administrator.\n\n * Only a fresh installation of BRAIN2 3.09 or later without\n installing Bizerba ScriptService prevents the issue during setup.\n\n * Do not install Bizerba ScriptService and use the BRAIN2 Device\n Control Service instead\n\n * Starting with BRAIN2 3.11, Bizerba ScriptService will no longer\n be included in the delivery"
}
],
"source": {
"advisory": "BIZERBA-SA-2026-0003",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-07T22:00:00.000Z",
"value": "Release of BRAIN2 3.09"
}
],
"title": "Insecure permission assignment due to execution of LogPathConfig.exe during setup",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cb\u003eAn automatic correction is not possible,\nas modifying permissions on %ProgramData% may affect the functionality of other\nsoftware installed on the system.\u003c/b\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cb\u003eA Windows administrator can reduce the\nrisk by:\u003c/b\u003e\u003c/p\u003e\n\n\u003cul\u003e\n \u003cli\u003e\u003cb\u003eremoving full control permissions for Everyone on %ProgramData%,\n and\u003c/b\u003e\u003c/li\u003e\n \u003cli\u003e\u003cb\u003eassigning the required permissions specifically to\n %ProgramData%\\Bizerba\\BRAIN2\\\u003c/b\u003e\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "An automatic correction is not possible,\nas modifying permissions on %ProgramData% may affect the functionality of other\nsoftware installed on the system.\n\n\n\n\n\nA Windows administrator can reduce the\nrisk by:\n\n\n\n\n * removing full control permissions for Everyone on %ProgramData%,\n and\n\n * assigning the required permissions specifically to\n %ProgramData%\\Bizerba\\BRAIN2\\"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2026-16246",
"datePublished": "2026-07-20T11:51:40.416Z",
"dateReserved": "2026-07-20T06:59:08.963Z",
"dateUpdated": "2026-07-20T13:02:48.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12509 (GCVE-0-2025-12509)
Vulnerability from cvelistv5 – Published: 2025-10-31 15:51 – Updated: 2025-10-31 17:43
VLAI
EPSS
VEX
Title
Scripts for the module Global_Shipping executable on BRAIN2 Server
Summary
On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12509",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-31T17:43:42.387454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T17:43:51.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "BRAIN2",
"vendor": "Bizerba",
"versions": [
{
"lessThan": "3.07",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bizerba:brain2:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "3.07",
"versionStartIncluding": "0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights."
}
],
"value": "On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T15:51:25.120Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0007.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version 3.07"
}
],
"value": "Update to version 3.07"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0007",
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2025-10-30T23:00:00.000Z",
"value": "Release of new version BRAIN2 3.07"
},
{
"lang": "en",
"time": "2025-10-30T23:00:00.000Z",
"value": "Publish Security Advisory"
}
],
"title": "Scripts for the module Global_Shipping executable on BRAIN2 Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "BRAIN2 users can be deprived of the right to implement Global_Shipping scripts.\u003cbr\u003e"
}
],
"value": "BRAIN2 users can be deprived of the right to implement Global_Shipping scripts."
}
],
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-12509",
"datePublished": "2025-10-31T15:51:25.120Z",
"dateReserved": "2025-10-30T14:08:51.595Z",
"dateUpdated": "2025-10-31T17:43:51.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12508 (GCVE-0-2025-12508)
Vulnerability from cvelistv5 – Published: 2025-10-31 15:49 – Updated: 2025-10-31 17:44
VLAI
EPSS
VEX
Title
Unencrypted communication to Active Directory services
Summary
When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-31T17:44:19.445267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T17:44:27.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "BRAIN2",
"vendor": "Bizerba",
"versions": [
{
"lessThan": "3.07",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bizerba:brain2:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "3.07",
"versionStartIncluding": "0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality."
}
],
"value": "When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T15:49:54.429Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0006.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version 3.07\u003cbr\u003e"
}
],
"value": "Update to version 3.07"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0006",
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2025-10-30T23:00:00.000Z",
"value": "Release of new version BRAIN2 3.07"
},
{
"lang": "en",
"time": "2025-10-30T23:00:00.000Z",
"value": "Publish Security"
}
],
"title": "Unencrypted communication to Active Directory services",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Do not use domain users as BRAIN2 users in unprotected networks. Use local BRAIN2 users instead."
}
],
"value": "Do not use domain users as BRAIN2 users in unprotected networks. Use local BRAIN2 users instead."
}
],
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-12508",
"datePublished": "2025-10-31T15:49:54.429Z",
"dateReserved": "2025-10-30T14:08:50.565Z",
"dateUpdated": "2025-10-31T17:44:27.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12507 (GCVE-0-2025-12507)
Vulnerability from cvelistv5 – Published: 2025-10-31 15:48 – Updated: 2025-10-31 18:17
VLAI
EPSS
VEX
Title
Insecure service configuration – unquoted path
Summary
The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba | _connect.BRAIN |
Affected:
0.0 , < 5.02
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-31T18:17:08.521501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T18:17:20.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "_connect.BRAIN",
"vendor": "Bizerba",
"versions": [
{
"lessThan": "5.02",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bizerba:_connect.brain:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "5.02",
"versionStartIncluding": "0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed.\u003cbr\u003e"
}
],
"value": "The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T15:48:36.371Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0005.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version \u2265 5.02\u003cbr\u003e"
}
],
"value": "Update to version \u2265 5.02"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0005",
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2025-01-15T23:00:00.000Z",
"value": "Release of new Version _connect.BRAIN 5.02"
},
{
"lang": "en",
"time": "2025-10-30T23:00:00.000Z",
"value": "Publish Security Advisory"
}
],
"title": "Insecure service configuration \u2013 unquoted path",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Enclose the service path in the registry in quotes: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\BCS\\ImagePath\u003cbr\u003e"
}
],
"value": "Enclose the service path in the registry in quotes: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\BCS\\ImagePath"
}
],
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-12507",
"datePublished": "2025-10-31T15:48:36.371Z",
"dateReserved": "2025-10-30T14:08:49.409Z",
"dateUpdated": "2025-10-31T18:17:20.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6512 (GCVE-0-2025-6512)
Vulnerability from cvelistv5 – Published: 2025-06-23 12:48 – Updated: 2025-06-23 13:22
VLAI
EPSS
VEX
Title
Scripts within reports executable on BRAIN2 Server
Summary
On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 |
Affected:
0.0 , < 3.06
(semver)
|
Date Public
2025-06-22 22:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6512",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T13:22:41.924297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T13:22:47.485Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"x86"
],
"product": "BRAIN2",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"lessThan": "3.06",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-06-22T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights."
}
],
"value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T12:48:33.951Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the newest Version 3.06\u003cbr\u003e"
}
],
"value": "Update to the newest Version 3.06"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0004",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2025-06-22T22:00:00.000Z",
"value": "Release of new Version BRAIN2 3.06"
}
],
"title": "Scripts within reports executable on BRAIN2 Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "BRAIN2 users can be deprived of the right to edit the reports\u003cbr\u003e"
}
],
"value": "BRAIN2 users can be deprived of the right to edit the reports"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-6512",
"datePublished": "2025-06-23T12:48:33.951Z",
"dateReserved": "2025-06-23T09:36:41.905Z",
"dateUpdated": "2025-06-23T13:22:47.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6513 (GCVE-0-2025-6513)
Vulnerability from cvelistv5 – Published: 2025-06-23 12:37 – Updated: 2025-06-23 13:25
VLAI
EPSS
VEX
Title
BRAIN2 Configuration file for database access not sufficiently secured
Summary
Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-260 - Password in Configuration File
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 |
Affected:
0.0 , < 3.06
(semver)
|
Date Public
2025-06-22 22:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T13:25:51.725596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T13:25:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"x86"
],
"product": "BRAIN2",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"lessThan": "3.06",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-06-22T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.\u003cbr\u003e"
}
],
"value": "Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-260",
"description": "CWE-260: Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T12:37:55.000Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0003.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the newest Version 3.06\u003cbr\u003e"
}
],
"value": "Update to the newest Version 3.06"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0003",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2025-05-24T22:00:00.000Z",
"value": "Release new BRAIN2 Version 3.06"
}
],
"title": "BRAIN2 Configuration file for database access not sufficiently secured",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eDeactivate not needed users or delete them\u003c/li\u003e\u003cli\u003eEnsure that only authorized users have access to the device/software\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Deactivate not needed users or delete them\n * Ensure that only authorized users have access to the device/software"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-6513",
"datePublished": "2025-06-23T12:37:55.000Z",
"dateReserved": "2025-06-23T09:36:49.537Z",
"dateUpdated": "2025-06-23T13:25:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2820 (GCVE-0-2025-2820)
Vulnerability from cvelistv5 – Published: 2025-03-26 14:58 – Updated: 2025-03-26 15:17
VLAI
EPSS
VEX
Title
Denial of Service
Summary
An authenticated attacker can compromise the availability of the device via the network
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | Product family GLx and CWx |
Affected:
0.0 , < 16.20
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2820",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-26T15:17:09.360360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-26T15:17:18.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Product family GLx and CWx",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"lessThan": "16.20",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated attacker can compromise the availability of the device via the network"
}
],
"value": "An authenticated attacker can compromise the availability of the device via the network"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-26T14:58:09.132Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0002.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the current Version of the device firmware\n\n\u003cbr\u003e"
}
],
"value": "Update to the current Version of the device firmware"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0002",
"discovery": "UNKNOWN"
},
"title": "Denial of Service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003ePrevent access for unauthorized Persons for FTP and SFTP\u003c/span\u003e\u003c/li\u003e\u003cli\u003eDisable FTP and SFTP\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "* Prevent access for unauthorized Persons for FTP and SFTP\n * Disable FTP and SFTP"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-2820",
"datePublished": "2025-03-26T14:58:09.132Z",
"dateReserved": "2025-03-26T14:52:26.131Z",
"dateUpdated": "2025-03-26T15:17:18.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2819 (GCVE-0-2025-2819)
Vulnerability from cvelistv5 – Published: 2025-03-26 14:49 – Updated: 2025-03-26 15:17
VLAI
EPSS
VEX
Title
Unrestricted Fileupload
Summary
There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | GT-SoftControl |
Affected:
0.0 , < 6.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-26T15:17:38.843313Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-26T15:17:46.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "GT-SoftControl",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"lessThan": "6.0",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.\n\n\u003cbr\u003e"
}
],
"value": "There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-26T14:49:38.291Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Software to the current version of the corresponding Software.\n\n\u003cbr\u003e"
}
],
"value": "Update Software to the current version of the corresponding Software."
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0001",
"discovery": "UNKNOWN"
},
"title": "Unrestricted Fileupload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cspan style=\"background-color: var(--wht);\"\u003ePrevent unauthorized physical access to the device\u003c/span\u003e\u003c/li\u003e\u003cli\u003eDisable E-Service to prevent remote access\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "* Prevent unauthorized physical access to the device\n * Disable E-Service to prevent remote access"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-2819",
"datePublished": "2025-03-26T14:49:38.291Z",
"dateReserved": "2025-03-26T14:42:48.119Z",
"dateUpdated": "2025-03-26T15:17:46.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}